More sophisticated attacks use a legitimate, cracked copy of GTA5.exe from a warez group, but bundle it with a malicious version.dll or dinput8.dll . Because GTA5.exe loads these libraries automatically via DLL search order hijacking, the game launches and runs perfectly—while silently exfiltrating browser cookies and cryptocurrency wallets in a background thread.